A flaw in the OneDev Pull Request Handler’s canAccessIssue function allows an attacker to manipulate the issue argument, resulting in improper authorization. The vulnerability can grant read or potentially edit access to issues that a user should not be able to view, weakening confidentiality and integrity of project data. It is a typical authorization bypass flaw identified as CWE‑266 and CWE‑285.

OneDev, versions up to and including 15.0.5 are affected. The updated release, OneDev 15.0.6, contains a fix that restores proper access checks. Any deployment running a vulnerable version is at risk until patched.

The CVSS base score of 5.3 places this vulnerability in the medium‑severity range, indicating a non‑critical but meaningful risk. No EPSS score is currently reported, and the issue is not listed in the CISA KEV catalog, so publicly available exploitation data is not known. Attackers can launch the exploit remotely by supplying a crafted issue identifier to the vulnerable endpoint; no local privilege or physical access is required.